Privacy Policy

CardConnect is provided by Manual 2 AI Private Limited (“Manual2AI”, “we”, “us”, or “our”). This policy applies to the CardConnect iOS app, web app, and related services.

Questions or privacy requests can be sent to support@manual2ai.com.

• Account and profile data: name, email address, phone number, company, designation, authentication provider, and account identifiers.
• Contact and relationship data: business-card images, names, professional contact details, companies, roles, websites, addresses, event details, tags, meeting context, notes, follow-up drafts, and follow-up status.
• Files you choose to add: brochures, documents, photos, or other attachments used with a follow-up.
• Voice context: microphone audio used while you dictate notes and the resulting transcript. The native app first uses Apple speech recognition. When you are signed in and online, CardConnect may send the bounded recording through its protected API for Google Gemini to clean up the transcript. The web app may also send a recording for transcription after you choose to record it.
• Purchase information: product, entitlement, and transaction identifiers needed to verify a subscription. Apple handles iOS billing and Razorpay handles web billing. Those providers handle full payment-card details; CardConnect does not receive them.
• Service and device data: scan timing and success, app actions, queue and sync status, notification subscription details, security events, request metadata, and diagnostic errors.

CardConnect also stores essential session and preference information on your device or in browser storage. We do not use third-party advertising cookies.

If you choose Google Sign-In, Google may provide your name, email address, profile picture, and Google account identifier. Supabase processes and stores that information with your authentication and CardConnect profile records. We use it to create, authenticate, secure, and show your account; personalize follow-up drafts you request; and prefill customer details if you start a web subscription checkout. A requested draft may send your name to Google Gemini, and web checkout may send your name and email address to Razorpay as described in section 5. Google Sign-In does not give CardConnect access to your Gmail, Google Drive, Google Contacts, or Google Calendar.

CardConnect asks for a permission only when a related feature needs it. You can change permissions in system settings.

• Camera and Photos let you capture or select a card, badge, QR code, or image.
• Microphone and Speech Recognition let you dictate meeting context.
• Contacts access is used to save a confirmed person only when you choose that action.
• Calendar access is used to create a follow-up event only when you choose that action.
• Notifications are used for follow-up reminders you enable.

• Authenticate you and keep your account secure.
• Extract business-card details, organize contacts and events, sync approved data, and keep offline work queued until connectivity returns.
• Produce an immediate on-device extraction or transcript in the native app, then optionally check selected capture details, clean up a transcript, or personalize a draft through Google Gemini when the signed-in device is online. The on-device result remains available if that enhancement fails.
• Prepare messages, reminders, exports, contact cards, and other actions you request. A draft is not treated as sent.
• Verify purchases and provide subscription features.
• Operate, troubleshoot, protect, and improve CardConnect, including measuring scan reliability and preventing misuse.
• Comply with law and enforce our terms.

We use service providers only as needed to operate CardConnect. These may include Supabase for authentication, databases, and storage; Vercel for web hosting and APIs; Apple and Google for sign-in and platform services; Google Gemini for bounded app and web extraction, transcription, or requested message assistance; Resend for a web email you direct CardConnect to send; and payment providers for subscription processing.

When you choose WhatsApp, email, phone, calendar, Contacts, or a share action, the relevant app or platform receives the information needed to perform that action under its own privacy terms. We may also disclose data when required by law, to protect users or the service, or as part of a business transaction subject to appropriate safeguards.

We do not sell personal data, use it for cross-app tracking, or share it for third-party targeted advertising.

Business cards and meeting notes can contain information about other people. You are responsible for collecting, storing, and contacting those people lawfully, respecting their choices, and avoiding spam or unwanted communications.

The native app can keep captures, contacts, events, and queue state on the device so capture can continue offline. Confirmed data may sync to your CardConnect account. We retain account data while your account is active and as reasonably needed to provide the service, resolve disputes, prevent abuse, and meet legal obligations.

You can export your data and request permanent account deletion from More → Privacyin the iOS app. Account deletion removes the account, associated application records, and files in CardConnect's user-scoped storage. Limited copies can remain temporarily in encrypted backups or security logs until normal retention cycles expire. We may retain a minimal provider transaction identifier and final subscription state when needed to prevent repeat charges, replayed purchases, fraud, or to meet legal obligations; this record does not contain card details or restore deleted contact data. Before account deletion completes, CardConnect cancels a linked Razorpay web subscription so it cannot charge again. Apple does not permit CardConnect to cancel an App Store subscription for you, so that subscription remains managed in your Apple Account settings.

We use access controls, encryption in transit, restricted service credentials, and other reasonable safeguards. No system can guarantee absolute security. Our providers may process data in countries other than yours, using contractual and technical safeguards appropriate to the service.

Depending on your location, you may have rights to access, correct, export, delete, restrict, or object to processing of personal data. Many of these controls are available in the app. You may also contact us at support@manual2ai.com. We may need to verify your identity before completing a request.

CardConnect is a professional networking service and is not directed to children under 13 or the minimum age required by local law. If you believe a child provided personal data, contact us so we can review and remove it.

We may update this policy as CardConnect or applicable law changes. We will post the revised policy here, update its effective date, and provide additional notice in the app when a material change requires it.